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Why GAO Did This Study 

Since 2002, the Department of 
Homeland Security (DHS) has 
distributed almost $20 billion in 
funding to enhance the nation's 
capabilities to respond to acts of 
terrorism or other catastrophic 
events. In fiscal year 2007, DHS 
provided approximately $1.7 billion 
to states and urban areas through 
its Homeland Security Grant 
Program (HSGP) to prevent, 
protect against, respond to, and 
recover from acts of terrorism or 
other catastrophic events. As part 
of the Omnibus Appropriations Act 
of 2007, GAO was mandated to 
review the methodology used by 
DHS to allocate HSGP grants. This 
report addresses (1) the changes 
DHS has made to its risk-based 
methodology used to allocate grant 
funding from fiscal year 2007 to 
fiscal year 2008 and (2) whether the 
fiscal year 2008 methodology is 
reasonable. To answer these 
questions, GAO analyzed DHS 
documents related to its 
methodology and grant guidance, 
interviewed DHS officials about the 
grant process used in fiscal year 
2007 and changes made to the 
process for fiscal year 2008, and 
used GAO's risk management 
framework based on best practices. 



What GAO Recommends 



GAO recommends that DHS 
formulate a methodology to 
measure variations in vulnerability 
across states and urban areas. In 
comments to our draft report, DHS 
components concurred with our 
recommendation. 



What GAO Found 

For fiscal year 2008 HSGP grants, DHS is primarily following the same 
methodology it used in fiscal year 2007, but incorporated metropolitan 
statistical areas (MSAs) within the model used to calculate risk. The 
methodology consists of a three-step process — a risk analysis of urban areas 
and states based on measures of threat, vulnerability and consequences, an 
effectiveness assessment of applicants' investment justifications, and a final 
allocation decision. The principal change in the risk analysis model for 2008 is 
in the definition of the geographic boundaries of eligible urban areas. In 2007, 
the footprint was defined using several criteria, which included a 10-mile 
buffer zone around the center city. Reflecting the requirements of the 
Implementing Recommendations of the 9/11 Commission Act of 2007, DHS 
assessed risk for the Census Bureau's 100 largest MSAs by population in 
determining its 2008 Urban Areas Security Initiative (UASI) grant allocations. 
This change altered the geographic footprint of the urban areas assessed, 
aligning them more closely with the boundaries used by government agencies 
to collect some of the economic and population data used in the model. This 
may have resulted in DHS using data in its model that more accurately 
estimated the population and economy of those areas. The change to the use 
of MSA data in fiscal year 2008 also resulted in changes in the relative risk 
rankings of some urban areas. As a result, DHS officials expanded the eligible 
urban areas in fiscal year 2008 to a total of 60 UASI grantees, in part, to 
address the effects of this change to MSA data, as well as to ensure that all 
urban areas receiving fiscal year 2007 funding continued to receive funding in 
fiscal year 2008, according to DHS officials. 

Generally, DHS has constructed a reasonable methodology to assess risk and 
allocate funds within a given fiscal year. The risk analysis model DHS uses as 
part of its methodology includes empirical risk analysis and policy judgments 
to select the urban areas eligible for grants (all states are guaranteed a 
specified minimum percentage of grant funds available) and to allocate State 
Homeland Security Program (SHSP) and UASI funds. However, our review 
found that the vulnerability element of the risk analysis model has limitations 
that reduce its value. Measuring vulnerability is considered a generally- 
accepted practice in assessing risk; however, DHS's current risk analysis 
model does not measure vulnerability for each state and urban area. Rather, 
DHS considered all states and urban areas equally vulnerable to a successful 
attack and assigned every state and urban area a vulnerability score of 1.0 in 
the risk analysis model, which does not take into account any geographic 
differences. Thus, as a practical matter, the final risk scores are determined 
by the threat and consequences scores. 
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Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile 

radius vs. MSA. 18 



This is a work of the U.S. government and is not subject to copyright protection in the 
United States. It may be reproduced and distributed in its entirety without further 
permission from GAO. However, because this work may contain copyrighted images or 
other material, permission from the copyright holder may be necessary if you wish to 
reproduce this material separately. 
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This report was revised on October 2, 2008 to reflect a change in the text 
on page 10, note "a" to figure 3, "The statutory minimum of 0.375 percent 
of the total funds appropriated for SHSP for fiscal year 2008. In fiscal 
years 2006 and 2007, the statutory per state minimum equaled 0. 75 
percent of funds appropriated for SHSP and UASI was revised to "The 
Statutory minimum of 0.375 percent of the total funds appropriated for 
SHSP and UASI for fiscal year 2008. In fiscal years 2006 and 2007, the 
statutory per state minimum equaled 0. 75 percent of funds appropriated 
for SHSP." 

Furthermore, Figure 5 on page 18 was revised to correctly illustrate the 
Wisconsin/Illinois border. 
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^ G A O 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



June 27, 2008 

The Honorable Robert C. Byrd Chairman 

The Honorable Thad Cochran Ranking Minority Member 

Subcommittee on Homeland Security 

Committee on Appropriations 

United States Senate 

The Honorable David E. Price, Chairman 

The Honorable Harold Rodgers, Ranking Minority Member 

Subcommittee on Homeland Security 

Committee on Appropriations 

House of Representatives 

Since 2002, the Department of Homeland Security (DHS) has distributed 
almost $20 billion in federal funding through various DHS grant programs 
that provide funding to public jurisdictions and private owners/operators 
for planning, equipment, and training to enhance the nation's capabilities 
to respond to terrorist attacks and, to a lesser extent, natural and 
accidental disasters. 1 In fiscal year 2007, DHS provided approximately $1.7 
billion to states and urban areas through its Homeland Security Grant 
Program (HSGP) to prevent, protect against, respond to, and recover from 
acts of terrorism or other catastrophic events and plans to distribute 
approximately $1.6 billion under this program in fiscal year 2008. 

The majority of funding from the Homeland Security Grant Program is 
provided through two of its five component programs: the State Homeland 
Security Program (SHSP) and the Urban Areas Security Initiative (UASI). 2 
SHSP supports building and sustaining capabilities at the state and local 
levels through planning, equipment, training, and exercise activities and 
helps states to implement the strategic goals and objectives included in 
state homeland security strategies. SHSP provides funding to all 56 states 



1 This figure includes such DHS grant programs as the Homeland Security Grant Program, 
Infrastructure Protection Programs, and the Emergency Management Performance Grants. 

2 In addition, HSGP encompasses three smaller grant programs: the Law Enforcement 
Terrorism Prevention Activities, the Metropolitan Medical Response System, and the 
Citizen Corps Program, which do not use a risk-based methodology to allocate funds to 
grantees. 



Page 1 



GAO-08-852 Homeland Security 



and territories based on a combination of assessing relative risk, and 
determining the effectiveness of states' proposed investments. 3 UASI 
addresses the unique multi-disciplinary planning, operations, equipment, 
training, and exercise needs of high-threat, high-density urban areas. The 
program provides funding to high-risk urban areas based on 
determinations of risk and assessments of the effectiveness of the plans 
for using the funds. DHS used this same risk-based methodology to 
allocate $852 million in fiscal year 2008 under the Infrastructure Protection 
Program, according to DHS. 4 

The distribution of HSGP funds, including UASI funding, has raised 
congressional interest about DHS's methods in making such 
determinations. For the third consecutive year, GAO has been mandated 
as part of DHS's annual appropriation to review and assess the HSGP's 
risk analysis model and risk-based allocation methodology 5 for 
determining risk and distributing funds. 6 We responded to the mandate in 
February 2008 by briefing the staffs of congressional committees on the 
results of this review (see Appendix I). This report and the accompanying 
appendices supplements and transmits the information provided during 
those briefings. 

In response to a mandate in the Consolidated Appropriations Act, 2008, 7 
GAO reviewed the methodology used by DHS to allocate HSGP grants. 
This report addresses the following questions: 

1. How has the risk-based methodology DHS uses to allocate grant 
funding changed from fiscal year 2007 to fiscal year 2008? 



3 Each state and territory receives a statutory minimum percentage of available funds. 

4 The Infrastructure Protection Program supports specific activities to protect critical 
infrastructure, such as ports, mass transit, highways, rail and transportation. The grant 
programs included here are Transit Security Grant Program, Port Security Grant Program, 
Buffer Zone Protection Program, Trucking Security Program, and Intercity Bus Security 
Grants. 

° For example, GAO Homeland Security Grants: Observations on Process DHS Used to 
Allocate Funds to Selected Urban Areas, GAO-07-381R (Washington, D.C.: Feb 7, 2007) 

6 For the purposes of this report, we use "risk analysis model" to refer to DHS's application 
of its risk calculation formula to score and rank states and urban areas. We use "risk-based 
allocation methodology" to refer to the three-step process it uses in determining and 
making grant fund allocations — risk analysis, effectiveness analysis, and final allocation 
decisions. 

7 Pub. L. No. 110-161, 121 Stat. 1844, 2063 (2007) 
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2. How reasonable is the fiscal year 2008 methodology? 

To answer these questions, we analyzed DHS documents, including the 
risk analysis models for fiscal years 2007 and 2008, grant guidance, and 
presentations. To provide a basis for examining efforts at carrying out risk 
management, we applied a framework for risk management that GAO 
developed based on best practices and other criteria. 8 We used our risk 
management framework to examine DHS's risk-based methodology — 
which includes its risk analysis model. Our analysis includes the extent to 
which: 

• Information used in DHS's methodology — such as specific measures 
and weights — was sufficient and reliable; 

• Attributes of DHS's methodology that potentially include both 
government and non-government items were identified by a reasoned 
process; 

• DHS could justify the aggregation or calculations of these attributes; 

• DHS documented its processes and applied written criteria when using 
methods to obtain scores or weights (ie. peer review), or when ranges 
or categories (ie. tiers) are used; 

• Relative risk rankings are sensitive to incremental changes in 
assumptions or alternative perceptions related to grantee eligibility or 
funding levels; and 

• DHS has procedures in place to update their methodology if new 
information becomes available. 

Finally, we interviewed DHS officials about the HSGP grant determination 
process used in fiscal year 2007 and about changes made to the process 
for fiscal year 2008. We performed this performance audit from September 
2007 through April 2008, in accordance with generally accepted 
government auditing standards. Those standards require that we plan and 
perform the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. 



8 GAO Risk Management: Further Refinements Needed to Assess Risks and Prioritize 
Protective Measures at Ports and Other Critical Infrastructure, GAO-06-91 (Washington, 
D.C.: Dec 15, 2005). 
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RGSllltS In Brief ^ sca ^ ^ ear HSGP grants, DHS is primarily following the same 

methodology it used in fiscal year 2007, but incorporated metropolitan 
statistical areas (MSAs) within the risk analysis model used to calculate 
risk. The methodology consists of a three-step process — risk analysis, 
effectiveness assessment, and final allocation decisions. The principal 
change in the model for 2008 is in the definition of the geographic 
boundaries, or footprint, of the UASI areas. In 2007, the footprint was 
defined using several criteria, which included a 10-mile buffer zone around 
the center city. Reflecting the requirements of the Implementing 
Recommendations of the 9/11 Commission Act of 2007 (9/11 Act), 9 DHS 
assessed risk for the Census Bureau's 100 largest MSAs by population in 
determining its 2008 UASI grant allocations. This change altered the 
geographic footprint of the urban areas assessed, aligning them more 
closely with the boundaries used by government agencies to collect some 
of the economic and population data used in the model, which may have 
resulted in DHS using data in its model that more accurately estimated the 
population and economy of those areas. As a result, DHS officials 
expanded the eligible urban areas in fiscal year 2008 to a total of 60 UASI 
grantees, in part, to address the effects of this change to MSA data, as well 
as to ensure that all urban areas receiving funding in fiscal year 2007 
received funding in fiscal year 2008, according to DHS officials. 

Generally, DHS has constructed a reasonable methodology to assess risk 
and allocate funds within a given fiscal year. The risk analysis model DHS 
uses as part of its methodology includes empirical risk analysis and policy 
judgments to select the urban areas eligible for grants (all states are 
guaranteed a specified minimum percentage of the grant funds available) 
and to allocate SHSP and UASI funds. However, our review found that the 
vulnerability element of the risk analysis model has limitations that reduce 
its value. Measuring vulnerability is considered a generally-accepted 
practice in assessing risk; however, DHS did not measure vulnerability for 
each state and urban area. Rather, DHS considered all states and urban 
areas equally vulnerable to a successful attack and assigned every state 
and urban area a vulnerability score of 1.0 in the risk model. Thus, as a 
practical matter, the final risk scores are determined by the threat and 
consequences scores. By not measuring variations in vulnerability, DHS 
ignores differences across states and urban areas. 



a 6 U.S.C. §§ 601(5), (8), 604(b). 
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To strengthen DHS's methodology for determining risk, we are 
recommending that the Secretary of DHS formulate a method to measure 
variations in vulnerability across states and urban areas, and apply this 
measure in future iterations of the risk analysis model. In email comments 
on the draft report, FEMA and I&A concurred with our recommendation 
that they formulate a method to measure vulnerability in a way that 
captures variations across states and urban areas and apply this 
vulnerability measure in future iterations of the risk-based grant allocation 
model. FEMA, NPPD and I&A also provided technical comments, which 
we incorporated as appropriate. 

Background Risk mana § emen t nas Deen endorsed by Congress, the President, and the 

" Secretary of DHS as a way to direct finite resources to those areas that are 

most at risk of terrorist attack under conditions of uncertainty. The 
purpose of risk management is not to eliminate all risks, as that is an 
impossible task. Rather, given limited resources, risk management is a 
structured means of making informed trade-offs and choices about how to 
use available resources effectively and monitoring the effect of those 
choices. Thus, risk management is a continuous process that includes the 
assessment of threats, vulnerabilities, and consequences to determine 
what actions should be taken to reduce or eliminate one or more of these 
elements of risk. 

To provide a basis for examining efforts at carrying out risk management, 
GAO developed 10 a framework for risk management based on best 
practices and other criteria. The framework is divided into five phases: (1) 
setting strategic goals and objectives, and determining constraints; (2) 
assessing the risks; (3) evaluating alternatives for addressing these risks; 
(4) selecting the appropriate alternatives; and (5) implementing the 
alternatives and monitoring the progress made and the results achieved 
(see Fig.l). 



10 GAO-06-91. 
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Figure 1 : Risk Management Framework 




Source: GAO. 



Because we have imperfect information for assessing risks, there is a 
degree of uncertainty in the information used for risk assessments (e.g., 
what the threats are and how likely they are to be realized). As a result, it 
is inevitable that assumptions and policy judgments must be used in risk 
analysis and management. It is important that key decision-makers 
understand the basis for those assumptions and policy judgments and 
their effect on the results of the risk analysis and the resource decisions 
based on that analysis. 

DHS has used an evolving risk-based methodology to identify the urban 
areas eligible for HSGP grants and the amount of funds states and urban 
areas receive (see Fig 2). For example, the risk analysis model used from 
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fiscal year 2001 through 2003 largely relied on measures of population to 
determine the relative risk of potential grant recipients, and evolved to 
measuring risk as the sum of threat, critical infrastructure and population 
density calculations in fiscal years 2004 and 2005. 
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Figure 2: Evolution of DHS's Risk-based formula 
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Source: GAO analysis based on Congressional Research Service. 

Notes: 

Definitions for the formulas above: 

• R = P represents Risk = Population; 

• R = T+CI+PD represents Risk = Threat plus Critical Infrastructure plus Population Density; 
. R = T*V*C represents Risk = Threat times Vulnerability times Consequences; and 

• R = T* "(V&C)" represents DHS's presentation of the risk calculation formula used in their risk 
analysis model for 2007 and 2008: Risk = Threat times the combination of Vulnerability and 
Consequences. However, in the 2007 and 2008 risk analysis models, the combination of 
vulnerability and consequence is still calculated as the product of V times C, or R = T*V*C. 

Federal legislation affecting DHS's risk-based methodology: 

• United and Strengthening America by Providing Appropriate Tools Required to Intercept and 
Obstruct Terrorism Act (USA PATRIOT Act) of 2001 : Legislated statutory minimum funding levels 
for states and territories to receive under SHSP (0.75 percent of SHSP appropriations for states, 
the District of Columbia and Puerto Rico; 0.25 percent for territories). 

• Homeland Security Act of 2002: Moved the Department of Justice's Office for Domestic 
Preparedness grant programs into DHS. 

• 9/1 1 Act: Legislated (a) minimum funding levels for state and territories to receive under SHSP 
(0.375 percent of all funds appropriated for SHSP and UASI for states, the District of Columbia 
and Puerto Rico (0.008 percent for territories) for FY 2008 with the state percentage decreasing 
each fiscal year down to 0.35 percent by FY2012, (b) that DHS is to assess the risk for 100 most 
populous Metropolitan Statistical Areas (MSAs), and (c) based on that assessment, designate 
high-risk urban areas that may apply for UASI grants. 
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The fiscal year 2006 process introduced assessments of threat, 
vulnerability and consequences of a terrorist attack in assessing risk. In 
addition to modifications to its risk analysis model, DHS adopted an 
effectiveness assessment for fiscal year 2006 to determine the anticipated 
effectiveness of the various risk mitigation investments proposed by urban 
areas, which affected the final amount of funds awarded to eligible areas. 
For the fiscal year 2007 allocation process, DHS defined Risk as the 
product of Threat times Vulnerability and Consequences, or "R= T* (V & 
C)" 11 and applied a three-step risk-based allocation methodology which 
incorporates analyses of risk and effectiveness to select eligible urban 
areas and allocate UASI and SHSP funds (see Fig. 3). The three steps 
include: 

1. Implementation of a Risk Analysis model to calculate scores for 
states and urban areas, defining relative Risk as the product of 
Threat, Vulnerability and Consequences; 

2. Implementation of an Effectiveness Assessment, including a 
process where state and urban area representatives acting as peer 
reviewers assess and score the effectiveness of the proposed 
investments submitted by the eligible applicants. This process is 
also known as peer review. 

3. Calculation of a Final Allocation of funds based on states' and 
urban areas' risk scores as adjusted by their effectiveness scores. 

The Post-Katrina Emergency Management Reform Act places 
responsibility for allocating and managing DHS grants with the Federal 
Emergency Management Agency (FEMA). 12 While FEMA is responsible for 
implementing the above 3-step process, FEMA relies on other DHS 
components such as the National Protection and Programs Directorate 
(NPPD) and the Office of Intelligence and Analysis (I&A) in the 



While DHS documents express their risk analysis model as a function of Threat times the 
combination of Vulnerability and Consequences,; mathematically, the 2007 risk analysis 
model was still calculated as the product of T times V times C, or R = T*V*C. The risk 
model considers the potential risk of international terrorism to people, critical 
infrastructure, and the economy to estimate the relative risk of terrorism faced by a given 
area. Risk is the product of Threat, the likelihood of an attack occurring, and Vulnerability 
and Consequence, the relative exposure to and expected impact of an attack. 

12 The Post-Katrina Emergency Management Reform Act of 2006 was enacted as Title VI of 
the Department of Homeland Security Appropriations Act, 2007, Pub. L. No. 109-295, 120 
Stat. 1355, 1394 (2006). 
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development of the risk analysis model, which we will discuss in greater 
detail below. 



Figure 3: Overview of the Grant Allocation Methodology for UASI and SHSP 
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Source: GAO analysis of DHS documents and information provided in interviews. 

"The statutory minimum of 0.375 percent of the total funds appropriated for SHSP and UASI for fiscal 
year 2008. In fiscal years 2006 and 2007, the statutory per state minimum equaled 0.75 percent of 
funds appropriated for SHSP. 



Risk Analysis Model DHS employs a risk analysis model to assign relative risk scores to all 

states and urban areas under the SHSP and UASI grant programs. These 
relative risk scores are also used to differentiate which urban areas are 
eligible for UASI funding. These eligible areas are divided into two tiers: 
Tier 1 UASI grantees and those eligible for Tier 2. 13 In fiscal year 2007, 45 



This tiering process was first used for the UASI grant program in fiscal year 2007. Its 
effect on funding allocation will be discussed in greater detail later in this report. 
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candidates were eligible to apply for funding under the UASI program, and 
eligible candidates were grouped into two tiers according to relative risk. 
Tier 1 included the six highest risk areas; Tier 2 included the other 39 
candidate areas. Figure 4 provides an overview of the factors that are 
included in the risk analysis model for fiscal year 2007 and their relative 
weights. The maximum relative risk score possible for a given area was 
100. The Threat Index accounted for 20 percent of the total risk score; the 
Vulnerability and Consequences Index accounted for 80 percent. 
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Figure 4: DHS's Risk Analysis Model Used in Determining Relative Risk Scores 
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Source: Census, LandScan, Smith 
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Economic Index 

Data: Gross Metropolitan Product 
(UASI)/percent GDP (state analysis) 

Source: Global Insight/Department 
of Commerce, Bureau of Economic 
Statistics 



National Infrastructure Index 

Data: #Tier I Assets (x3) +#Tier II 
Assets 

Source: DHS/OIP, SSAs, states and 
territories. 
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National Security Index 



Data: Presence of Military Bases (yes/no) 
+ # DIB + # intnational border crossings 
Source: DOD, DHS/CBP 



Source: DHS. 

Note: "DHS/OIP" stands for DHS's Office of Infrastructure Protection. "SSAs" stands for Sector- 
Specific Agencies, which are Federal departments and agencies identified in the National 
Infrastructure Protection Plan as responsible for critical infrastructure protection activities. "DHS/CBP" 
stands for the DHS's Customs and Border Protection. "DIB" stands for "defense industrial base," 
which includes a count of Department of Defense, government, and private sector industrial complex 
with capabilities to perform research and development, design, produce, and maintain military 
weapon systems, subsystems, components and parts to meet military requirements. "GDP" stands for 
Gross Domestic Product. 



The Threat Index accounted for 20 percent of the total risk score, which 
was calculated by assessing threat information for multiple years 
(generally, from September 11, 2001 forward) for all candidate urban areas 
and categorizing urban areas into different threat tiers. According to DHS 
officials, the agency's Office of Intelligence and Analysis (I&A) calculated 
the Threat Index by (1) collecting qualitative threat information with a 
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nexus to international terrorism, 14 (2) analyzing the threat information to 
create threat assessments for states and urban areas, (3) empanelling 
intelligence experts to review the threat assessments and reach consensus 
as to the number of threat tiers, and (4) assigning threat scores. This 
process, according to DHS officials, relied upon analytical judgment and 
interaction with the Intelligence Community, as opposed to the use of total 
counts of threats and suspicious incidents to calculate the Threat Index 
for the 2006 grant cycle. The final threat assessments are approved by the 
Intelligence Community — the Federal Bureau of Investigation, Central 
Intelligence Agency, National Counterterrorism Center, and the Defense 
Intelligence Agency — along with the DHS Under Secretary for Intelligence 
and Analysis and the Secretary of DHS, according to DHS officials. 

The Vulnerability and Consequences index accounts for 80 percent of the 
total risk score. Because DHS considered most areas of the country 
equally vulnerable to a terrorist attack given freedom of movement within 
the nation, DHS assigns vulnerability a constant value of 1.0 in the formula 
across all states and urban areas. Therefore, DHS's measurement of 
vulnerability and consequences is mainly a function of the seriousness of 
the consequences of a successful terrorist attack, represented by four 
indices: a Population Index, an Economic Index, a National Infrastructure 
Index, and a National Security Index. 

Population Index (40 percent). This index included nighttime 
population and military dependent populations for states and urban 
areas, based upon U.S. Census Bureau and Department of Defense 
data. For urban areas, factors such as population density, estimated 
number of daily commuters, and estimated annual visitors were also 
included in this variable using data from private entities. DHS 
calculated the Population Index for urban areas by identifying areas 
with a population greater than 100,000 persons and cities that reported 
threat data during the past year, then combined cities or adjacent 
urban counties with shared boundaries to form single jurisdictions, 
and drew a 10-mile buffer zone around identified areas. 

Economic Index (20 percent). This index is comprised of the economic 
value of the goods and services produced in either a state or an urban 
area. For states, this index was calculated using U.S. Department of 
Commerce data on their percentage contribution to Gross Domestic 



14 This threat information does not consider either domestic terrorism or natural hazards 
such as hurricanes or earthquakes, according to DHS's Office of Intelligence and Analysis. 
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Product. For UASI urban areas, a parallel calculation of Gross 
Metropolitan Product was incorporated. 15 

National Infrastructure Index (15 percent). This index focused on over 
2,000 critical infrastructure/key resource (CIKR) assets that were 
identified by DHS's Office of Infrastructure Protection. These 
particular critical infrastructure assets are divided into two rankings 
that, if destroyed or disrupted, could cause significant casualties, 
major economic losses, or widespread/long term disruptions to 
national well-being and governance capacity. The Tier 2 CIKR assets 
include the nationally-significant and high-consequence assets and 
systems across 17 sectors. 16 Tier 1 assets are a small subset of the Tier 
2 list that include assets and systems certain to produce at least two of 
four possible consequences if disrupted or destroyed: (1) prompt 
fatalities greater that 5,000; (2) first-year economic impact of at least 
$75 billion; (3) mass evacuations with prolonged (6 months or more) 
absence; and (4) loss of governance or mission execution disrupting 
multiple regions or critical infrastructure sectors for more than a 
week, resulting in a loss of necessary services to the public. Tier 1 
assets were weighted using an average value three times as great as 
Tier 2 assets. 

The National Security Index (5 percent). This index considered three 
key national security factors: whether military bases are present in the 
state or urban area; how many critical defense industrial base facilities 
are located in the state or urban area; and the total number of people 
traversing international borders. Information on these inputs comes 
from the Department of Defense and DHS. 



Effectiveness Assessment In addition to determining relative risk using the risk analysis model, DHS 

added an effectiveness assessment process in fiscal year 2006 to assess 
and score the effectiveness of the proposed investments submitted by 



15 For the urban areas in Puerto Rico, DHS split the total GDP of Puerto Rico published in 
the CIA World Factbook into Puerto Rico's constituent municipios according to the 
municipios' percentage of total non-farm employees, a figure provided by the Bureau of 
Labor Statistics. 

16 The 17 critical infrastructure sectors and key resources include agriculture and food, 
banking and finance, chemical, commercial facilities, dams, defense industrial base, 
emergency services, energy, government, information and telecommunications, national 
monuments and icons, postal and shipping, public health, transportation, and water 
sectors. 
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grant applicants. To assess the anticipated effectiveness of the various risk 
mitigation investments that states and urban areas proposed, DHS 
required states and urban areas to submit investment justifications as part 
of their grant applications. The investment justifications included up to 15 
"investments" or proposed solutions to address homeland security needs, 
which were identified by the states and urban areas through their strategic 
planning process. DHS used state and urban area representatives as peer 
reviewers to assess these investment justifications. The criteria reviewers 
used to score the investment justifications included the following 
categories: relevance to national, state and local plans and policies such as 
the National Preparedness Guidance states' and urban areas' homeland 
security plans, anticipated impact, sustainability, regionalism, and the 
applicants' planned implementation of each proposed investment. 
Reviewers on each panel assigned scores for these investment 
justifications, which, according to DHS officials, were averaged to 
determine a final effectiveness score for each state and urban area 
applicant. 

In fiscal year 2007, DHS provided states and urban areas the opportunity 
to propose investment justifications that included regional collaboration 
to support the achievement of outcomes that could not be accomplished if 
a state or urban area tried to address them independently. States and 
urban areas could choose to submit multi-state or multi-urban area 
investment justifications which outlined shared investments between two 
or more states or between two or more urban areas. Such investments 
were eligible for up to 5 additional points on their final effectiveness score, 
or up to 8 more effectiveness points for additional proposed investments, 
although these additional points would not enable a state's or urban area's 
total effectiveness score to exceed 100 points. These proposed 
investments were reviewed by one of two panels established specifically 
to consider multi-applicant proposals. Points were awarded based on the 
degree to which multi-applicant investments showed collaboration with 
partners and demonstrated value or outcomes from the joint proposal that 
could not be realized by a single state or urban area. 



Final Allocation Process DHS allocated funds based on the risk scores of states and urban areas, as 

adjusted by their effectiveness scores. DHS officials explained that while 
allocations are based first upon area risk scores, the effectiveness scores 
are then used to determine adjustments to states and urban areas 
allocations based on an "effectiveness multiplier." States and urban areas 
with high effectiveness scores received an additional percentage of their 
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risk-based allocations, while states and urban areas with low effectiveness 
scores had their risk-based allocations lowered by a percentage. 17 

In addition to determining funding by risk score as adjusted by an 
effectiveness multiplier, urban areas that received funds through the UASI 
grant program were subject to an additional tiering process that affected 
funding allocation. For example, in fiscal year 2007, the 45 eligible urban 
area candidates were grouped into two tiers according to relative risk. The 
Tier 2 UASI grantees included the 6 highest-risk areas; Tier 2 UASI 
grantees included another 39 candidate areas ranked by risk. The 6 Tier 1 
UASI grantees were allocated fifty-five percent of the available funds, or 
approximately $410.8 million, while the 39 Tier 2 UASI grantees received 
the remaining forty-five percent of available funds, or approximately 
$336.1 million. 



Shifting to Urban Area 
Boundaries Defined 
by MSA was the 
Primary Change to 
DHS's Risk-Based 
Methodology in 2008 



DHS's risk-based methodology had few changes from fiscal year 2007 to 
2008. DHS changed the definition it used to identify the UASI areas 
included in the risk analysis model in 2008 from an urban area's center city 
plus a ten-mile radius to metropolitan statistical areas (MSAs) as defined 
by the Census Bureau. 18 DHS made this change in response to the 9/llAct 
requirement to perform a risk assessment for the 100 largest MSAs by 
population. 19 Because the change in definition generally expanded the 
geographic area of each potential UASI grant recipient, the change had an 
effect on the data used to assess threat and consequences, and it may also 
have resulted in the use of more accurate data in the risk analysis model. 
The change to the use of MSA data in fiscal year 2008 also resulted in 
changes in the relative risk rankings of some urban areas. As a result, DHS 
officials expanded the eligible urban areas in fiscal year 2008 to a total of 
60 UASI grantees, in part, to address the effects of this change to MSA 
data, as well as to ensure that all urban areas that received fiscal year 2007 



States are statutorily required to receive a minimum percentage of the total funds 
appropriated for SHSP and UASI, and adjustments based on their effectiveness cannot 
lower a state's risk-based allocation below that threshold. UASI urban areas do not have a 
similar minimum. 

18 Additionally, fiscal year 2008 is the first year that FEMA has had responsibility for the 
risk assessment and grant allocations for these grants. 

19 In addition to the change to the definition DHS used to identify the UASI areas, DHS also 
incorporated population density for the SHSP risk analysis model and the presence of 
international waterways, based on the language of the Implementing Recommendations of 
the 9/11 Commission Act of 2007. 
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funding also received funding for fiscal year 2008, according to DHS 
officials. 

Changing the boundaries had an effect on the data by which risk is 
calculated because the change in boundaries resulted in changes in the 
population and critical assets within the new boundaries. Figure 3 below 
uses the Chicago, IL urban area to illustrate this change. One benefit of the 
change to MSAs was that the UASI boundaries align more closely with the 
boundaries used to collect some of the economic and population data used 
in the model. Consequently, the fiscal year 2008 model may have resulted 
in more accurate data. Because the 2007 boundaries were based on 
distance, areas inside the boundaries may have included partial census 
tracts or partial counties, each of which would have required DHS to 
develop rules as to how to handle the partial areas. By contrast, the MSAs 
are based on counties and allow DHS to use standard census data instead 
of developing an estimated population within the defined boundaries. 
Additional information describing the boundaries of UASI urban areas for 
fiscal year 2007 versus fiscal year 2008 is presented in Appendix II. 
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Figure 5: Chicago, IL Urban Area Footprint: Center City + 10 mile radius vs. MSA. 




10-mile radius 



Source: GAO analysis. 

DHS calculated the Population Index of MSAs by: (1) using census data to 
determine the population and population density of each census tract; (2) 
calculating a Population Index for each individual census tract by 
multiplying the census tract's population and population density figures; 
and (3) adding together the population indices of all of the census tracts 
making up the MSA. DHS did not use average population density because 
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using an average resulted in losing information about how the population 
is actually distributed among the tracts. Using averages for population 
density over census tracts with dissimilar densities could have yielded 
very misleading results, according to DHS officials. 

The change to MSAs for fiscal year 2008 resulted in an increase of almost 
162,000 square miles across the total area of urban area footprints. While 3 
urban areas actually lost square mileage because of the change, the other 
areas all increased their square mileage footprint by almost 2,700 square 
miles on average. The increased size of urban areas' footprints increased 
the number of critical infrastructure assets that were counted within them. 
We analyzed the number of Tier 1 and Tier 2 critical infrastructure assets 
associated with UASI areas between fiscal year 2007 and 2008, and found a 
higher number of total Tier 1 and Tier 2 critical infrastructure assets 
assigned to urban areas in 2008, and-individually — almost all urban areas 
increased the number of assets assigned to them. 

This change to the use of MSAs also resulted in changes in urban areas 
rankings, including the increase of the relative risk scores for such urban 
areas as Albany, Syracuse and Rochester, NY, and Bridgeport, CT. As a 
result, DHS officials expanded the eligible urban areas in fiscal year 2008 
to a total of 60 with the top seven highest risk areas comprising UASI Tier 
1 grantees, and the 53 other risk-ranked UASI Tier 2 grantees. As in fiscal 
year 2007, the top seven UASI Tier 1 grantee areas will receive fifty-five 
percent of the available funds, or approximately $429.9 million, and the 
remaining 53 UASI Tier 2 grantees will receive forty-five percent of the 
available funds, or approximately $351.7 million. According to DHS 
officials, the decision to expand the eligible urban areas to a total of sixty 
was a policy decision largely driven by two factors: the 9/11 Act 
requirement that FEMA use MSAs; and the desire to continue to fund 
urban areas already receiving funding. 
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DHS's Risk-based 
Methodology is 
Generally Reasonable, 
But the Vulnerability 
Element of the Risk 
Analysis Model Has 
Limitations that 
Reduce Its Value 



The risk-based methodology DHS uses to allocate HSGP grant dollars is 
generally reasonable. It includes and considers the elements of risk 
assessment — Threat, Vulnerability, and Consequences — and, as DHS's 
risk-based methodology has evolved, its results have become less sensitive 
to changes in the key assumptions and weights used in the risk analysis 
model. 20 Furthermore, the indices that DHS uses to calculate the variable 
constituting the greatest portion of the risk analysis model — 
Consequences — are reasonable. However, limitations such as the absence 
of a method for measuring variations in vulnerability reduce the 
vulnerability element's value. Although DHS recognized and described the 
significance of Vulnerability in its FY 2006 model, the model DHS used for 
fiscal years 2007 and 2008 used a constant value of 1.0 in its formula, 
rather than measuring variations in vulnerability across states and urban 
areas. 



DHS's Risk Analysis Model 
is Reasonable Because it 
Contains the Key Elements 
of Risk Assessment, Relies 
on Reasonable Indices to 
Measure Consequences, 
and is Less Sensitive to 
Changes in Variables 



One measure of the reasonability of DHS's risk-based methodology is the 
extent to which DHS's risk analysis model provides a consistent method to 
assess risk. Risk assessment helps decision makers identify and evaluate 
potential risks facing key assets or missions so that countermeasures can 
be designed and implemented to prevent or mitigate the effects of the 
risks. 21 In a risk management framework, risk assessment is a function of 
Threat, Vulnerability, and Consequences, and the product of these 
elements is used to develop scenarios and help inform actions that are 
best suited to prevent an attack or mitigate vulnerabilities to a terrorist 
attack. Threat is the probability that a specific type of attack will be 
initiated against a particular target/class of targets, and analysis of threat- 
related data is a critical part of risk assessment. The Vulnerability of an 
asset is the probability that a particular attempted attack will succeed 
against a particular target or class of targets. It is usually measured against 
some set of standards, such as availability/predictability, accessibility, 
countermeasures in place, and target hardness (the material construction 
characteristics of the asset). The Consequences of a terrorist attack 
measures the adverse effects of a successful attack and may include many 



A model is sensitive when a model produces materially different results in response to 
small changes in its assumptions. Ideally, a model that accurately and comprehensively 
assesses risk would not be sensitive, and such a model exhibiting little sensitivity could be 
said to be more robust than a model with more sensitivity to changes in assumptions 
underlying the model. 

21 A countermeasure is any action taken or physical equipment used principally to reduce 
or eliminate one or more vulnerabilities. 
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forms, such as the loss of human lives, economic costs, and adverse 
impact on national security. The risk analysis model used by DHS is 
reasonable because it attempts to capture data on threats, vulnerabilities, 
and consequences — the three types of information used in evaluating risk. 

Because DHS considered most areas of the country equally vulnerable to a 
terrorist attack given freedom of movement within the nation, DHS assigns 
vulnerability a constant value of 1.0 in the formula across all states and 
urban areas. Therefore, DHS's measurement of vulnerability and 
consequences is mainly a function of the seriousness of the consequences 
of a successful terrorist attack. Because the risk analysis model is 
consequences-driven, another measure of the model's overall 
reasonableness is the extent to which the indices used to calculate the 
consequences component of the model are reasonable. As previously 
described, the consequences component of the model is comprised of four 
indices - a Population Index, an Economic Index, a National 
Infrastructure Index, and a National Security Index - each assigned a 
different weight. These indices are generally reasonable. 

Both the population and economic indices are calculated from data 
derived from reliable sources that are also publicly available, providing 
additional transparency for the model. For example, according to DHS 
officials, the fiscal year 2008 analysis used Gross Metropolitan Product 
(GMP) estimates prepared by the consulting firm Global Insight for the 
United States Conference of Mayors and the Council for the New 
American City that were published in January 2007, and reported on the 
GMP for 2005. In addition, the National Infrastructure Index focused on 
over 2,000 Tier land Tier 2 critical infrastructure/key resource assets 
identified by DHS's Office of Infrastructure Protection (IP). For both fiscal 
years 2007 and 2008, DHS used a collaborative, multi-step process to 
create the Tier 2 CIKR list. First, IP works with sector-specific agencies to 
develop criteria used to determine which assets should be included in the 
asset lists. Second, these criteria are vetted with the private-sector through 
sector-specific councils, who review the criteria and provide feedback to 
IP. Third, IP finalizes the criteria and provides it to the sector-specific 
agencies and State and Territorial Homeland Security Advisors (HSAs). 
Fourth, IP asks states to nominate assets within their jurisdiction that 
match the criteria. Fifth, assets nominated by states are reviewed by both 
the sector-specific agencies and IP to decide which assets should comprise 
the final Tier 2 list. For example, to identify the nation's critical energy 
assets, IP will work with the Department of Energy to determine which 
assets and systems in the energy sector would generate the most serious 
economic consequences to the Nation should they be destroyed or 
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disrupted. Further, in the fiscal year 2008 process, IP added a new, 
additional step to allow for the resubmission of assets for reconsideration 
if they are not initially selected for the Tier 2 list. In addition, the National 
Security Index comprises only a small fraction of the model - 5 percent - 
and has also evolved to include more precision, such as counting the 
number of military personnel instead of simply the presence or absence of 
military bases. To identify the nation's critical defense industrial bases, 
the Department of Defense analyzes the impact on current warfighting 
capabilities, recovery and reconstitution, threat, vulnerability, and 
consequences of possible facility disruption and destruction, and other 
aspects. 

DHS's approach to calculating threat, which accounts for the remaining 20 
percent of the model, also represents a measure of the model's overall 
reasonableness. DHS uses analytical judgments to categorize urban areas' 
threat, which ultimately determines the relative threat for each state and 
urban area. DHS has used written criteria to guide these judgments, and 
DHS provided us with the criteria used in both of these years for our 
review. The criteria are focused on threats from international terrorism 
derived from data on credible plots, planning, and threats from 
international terrorist networks, their affiliates, and those inspired by such 
networks. The criteria provided guidance for categorizing areas based on 
varying levels of both the credibility and the volume of threat reporting, as 
well as the potential targets of threats. Results of this process are shared 
with the DHS Undersecretary for Intelligence and Analysis, the FBI, and 
the National Counterterrorism Center, all of whom are afforded the 
opportunity to provide feedback on the placements. Additionally, DHS 
develops written threat assessments that indicate whether states are 
"high," "medium," or "low" threat states. States can provide threat 
information that they have collected to DHS, but in order for that 
information to affect a state's tier placement and threat level, the 
information must be relevant to international terrorism, according to DHS 
officials. We reviewed several examples of these assessments from 2007, 
which included key findings describing both identified and potential 
threats to the state. The classified assessments addressed potential 
terrorist threats to critical infrastructure in each of the 56 states and 
territories. However, DHS shared assessments only with state officials 
who had appropriate security clearances. According to DHS officials, 
states without officials with sufficient clearances will receive an 
unclassified version of their state's assessment for the fiscal year 2009 
grant process. DHS is also developing a process by which they can share 
the threat assessments with UASI areas, including those UASI areas whose 
boundaries cross state lines; however, currently the assessments are 
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transmitted only to the DHS state representatives and state officials, and 
the states and representatives are responsible for sharing the information 
with the UASI areas, according to DHS officials. 

Another measure of the overall reasonableness of DHS's risk analysis 
model is the extent to which the model's results change when the 
assumptions and values built into the model, such as weights of variables, 
change. A model is sensitive when a model produces materially different 
results in response to small changes in its assumptions. Ideally, a model 
that accurately and comprehensively assesses risk would not be sensitive, 
and such a model exhibiting little sensitivity could be said to be more 
robust than a model with more sensitivity to changes in assumptions 
underlying the model. A robust calculation or estimation model provides 
its users greater confidence in the reliability of its results. For both fiscal 
years 2007 and 2008, substantial changes had to be made to the weights of 
any of the indices used in the risk model to calculate state and urban area 
risk scores before there was any movement in or out of the top 7 (or Tier 
1) ranked UASI areas. In other words, the model provides DHS with a level 
of assurance that the highest at-risk areas have been appropriately 
identified. While Tier 1 UASI areas were similarly robust in both FY 2007 
and FY 2008, the sensitivity of Tier 2 UASI areas to changes in the weights 
of indices used to calculate risk scores was significant in FY 2007, but 
improved in FY 2008. In FY 2007, very small changes in the weights for the 
indices used to quantify risk (for Tier 2 UASI areas at the eligibility cut 
point) resulted in changes in eligibility; however, FY 2008 results are more 
robust, as eligibility of urban areas is much less sensitive to changes in the 
index weights in the FY2008 model than it was in the FY2007 model. 
Appendix III provides an in-depth description of the sensitivity of the 
model to specific changes in the relative weights of each index for Tier 1 
and Tier 2 UASI areas. 



Vulnerability Element of 
the Risk Analysis Model 
Has Limitations that 
Reduce Its Value 



Although the methodology DHS uses is reasonable, the vulnerability 
element of the risk analysis model — as currently calculated by DHS — has 
limitations that reduce its value for providing an accurate assessment of 
risk. DHS considered most areas of the country equally vulnerable to a 
terrorist attack in the risk analysis model used for fiscal years 2007 and 
2008 and assigned a constant value to vulnerability, which ignores 
geographic differences in the social, built, and natural environments 
across states and urban areas. Although DHS recognized and described the 
significance of vulnerability in its FY 2006 model, the model used for fiscal 
years 2007 and 2008 did not attempt to measure vulnerability. Instead, 
DHS considered most areas of the country equally vulnerable to a terrorist 
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attack due to the freedom of individuals to move within the nation. As a 
result, DHS did not measure vulnerability, but assigned it a constant value 
of 1.0 across all states and urban areas. 

Last year we reported that DHS measured the vulnerability of an asset type 
as part of its FY2006 risk analysis. 22 DHS used internal subject matter 
experts who analyzed the general attributes of an asset type against 
various terrorist attack scenarios by conducting site vulnerability analyses 
on a sample of sites from the asset type in order to catalog attributes for 
the generic asset. These experts evaluated vulnerability by attack scenario 
and asset type pairs and assigned an ordinal value to the pair based on 10 
major criteria. In describing its FY 2006 methodology, DHS acknowledged 
that because all attack types are not necessarily applicable to all 
infrastructures, the values for threat must be mapped against vulnerability 
to represent the greatest likelihood of a successful attack. DHS also 
acknowledged that vulnerability of an infrastructure asset was also a 
function of many variables and recognized that it did not have sufficient 
data on all infrastructures to know what specific vulnerabilities existed for 
every infrastructure, what countermeasures had been deployed, and what 
impact on other infrastructures each asset had. At that time, DHS noted it 
would require substantial time and resource investment to fully develop 
the capability to consistently assess and compare vulnerabilities across all 
types of infrastructure. 

Vulnerability is a crucial component of risk assessment. An asset may be 
highly vulnerable to one mode of attack but have a low level of 
vulnerability to another, depending on a variety of factors, such as 
countermeasures already in place. According to our risk management 
framework, the vulnerability of an asset is the probability that a particular 
attempted attack will succeed against a particular target or class of 
targets. It is usually measured against some set of standards, such as 
availability/predictability, accessibility, countermeasures in place, and 
target hardness (the material construction characteristics of the asset). 
Each of these four elements can be evaluated based on a numerical 
assignment corresponding to the conditional probability of a successful 
attack. Additionally, other research has developed methods to measure 
vulnerability across urban areas. For example, one study described a 
quantitative methodology to characterize the vulnerability of U.S. urban 
centers to terrorist attack for the potential allocation of national and 
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regional funding to support homeland security preparedness and response 
in U.S. cities. 23 This study found that vulnerability varied across the 
country, especially in urban areas. The study noted that "place matters," 
and a one-size-fits all strategy ignores geographic differences in the social, 
built, and natural environments. Furthermore, in February of 2008 the 
Secretary of DHS said that "as we reduce our vulnerabilities, the 
vulnerabilities change as well." However, while earlier iterations of the 
risk analysis model attempted to measure vulnerability, DHS's risk 
analysis model now considers the states and urban areas of the country 
equally vulnerable to a terrorist attack and assigns a constant value to 
vulnerability, which ignores geographic differences. 



Conclusions * n *" lsca ^ ^ ear 2008, DHS will distribute approximately $1.6 billion to states 

and urban areas through its Homeland Security Grant Program - a 
program that has already distributed approximately $20 billion over the 
past six years - to prevent, protect against, respond to, and recover from 
acts of terrorism or other catastrophic events. Given that risk management 
has been endorsed by the federal government as a way to direct finite 
resources to those areas that are most at risk of terrorist attack under 
conditions of uncertainty, it is important that DHS use a reasonable risk- 
based allocation methodology and risk analysis model as it allocates those 
limited resources. 



DHS's risk-based allocation methodology and risk analysis model are 
generally reasonable tools for measuring relative risk within a given fiscal 
year, considering its use of a generally-accepted risk calculation formula; 
key model results' decreased sensitivity to incremental changes in the 
assumptions related to Tier 1 UASI grantees or the eligibility for Tier 2 
UASI funding, the reliability of the consequence variable component 
indices, and its adoption of MSAs to calculate urban area footprints. 
However, the element of vulnerability in the risk analysis model could be 
improved to more accurately reflect risk. Vulnerability is a crucial 
component of risk assessment, and our work shows that DHS needs to 
measure vulnerability as part of its risk analysis model to capture 
variations in vulnerability across states and urban areas. 



See Society for Risk Analysis Benchmark Analysis for Quantifying Urban Vulnerability 
to Terrorist Incidents Piegorsch, Walter W., Susan L. Cutter and Frank Hardisty Risk 
Analysis Vol. 27, No. 6, 2007. 



Page 25 



GAO-08-852 Homeland Security 



To strengthen DHS's methodology for determining risk, we are 
recommending that the Secretary of DHS take the following action: 



• Instruct FEMA, I&A, and NPPD - DHS components each responsible for 
aspects of the risk-based methodology used to allocate funds under the 
Homeland Security Grant Program - to formulate a method to measure 
vulnerability in a way that captures variations across states and urban 
areas, and apply this vulnerability measure in future iterations of this 
risk-based grant allocation model. 



We requested comments on a draft of this report from the Secretary of 
Homeland Security, FEMA, I&A, and NPPD, or their designees. In email 
comments on the draft report, FEMA and I&A concurred with our 
recommendation that they formulate a method to measure vulnerability in 
a way that captures variations across states and urban areas and apply this 
vulnerability measure in future iterations of the risk-based grant allocation 
model. FEMA, I&A, and NPPD also provided technical comments, which 
we incorporated as appropriate. 



We are sending copies of this correspondence to the appropriate 
congressional committees, and the Secretary of Homeland Security. 

Contact points for our Offices of Congressional Relations and Public 
Affairs may be found on the last page of this report. For further 
information about this report, please contact William Jenkins, Jr., Director, 
GAO Homeland Security and Justice Issues Team, at (202)-5 12-8777 or at 
jenkinswo@gao.gov. GAO staff members who were major contributors to 
this report are listed in appendix IV. 




William Jenkins, Jr., Director, 

Homeland Security and Justice Issues Team 



Agency Comments 
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Appendix I: Briefing for Congressional 
Committees, February 11-25, 2008 



For the third consecutive year, GAO has been mandated as part of DHS's 
annual appropriation to review and assess the HSGP's risk analysis model 
and risk-based allocation methodology for determining risk and 
distributing funds. We responded to the mandate in February 2008 by 
briefing the staffs of congressional committees on the results of this 
review. During the course of our engagement, we had ongoing dialog with 
DHS officials regarding the extent to which written criteria were used in 
the development of the Threat Index. At that time, officials from DHS's 
Office of Intelligence and Analysis stated that the criteria were not 
documented. As a result, we noted in the accompanying presentation 
slides that DHS's approach to measuring threat did not include specific, 
written criteria to use when determining the threat tiers into which states 
and urban areas are placed. 

As part of GAO's agency protocols, we convened an exit conference with 
DHS officials which occurred on April 14, 2008. We provided them with a 
statement of facts to reflect the information gathered during our 
engagement. At this exit conference an official from the Office of 
Intelligence and Analysis said DHS had used criteria in 2007 and 2008 for 
categorizing cities and states based on threat, and in further discussions 
with DHS we were able to independently review these documents and 
confirm that such criteria were used in the development of the Threat 
Index, which is reflected in the letter above. However, we did not modify 
the accompanying presentation contained in this appendix. 
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Appendix I: Briefing for Congressional 
Committees, February 11-25, 2008 
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Introduction 



According to the Department of Homeland Security (DHS), in fiscal 
year 2007: 

• DHS provided approximately $1 .7 billion to states and urban areas 
through its Homeland Security Grant Program (HSGP) to prevent, 
protect against, respond to, and recover from acts of terrorism or 
other catastrophic events. DHS plans to distribute about $1 .6 billion 
for these grants in fiscal year 2008. 

• The HSGP risk-based allocation process is used for the State 
Homeland Security Program (SHSP) and Urban Area Security 
Initiative (UASI). 

• In addition, DHS used this same approach to allocate $655 million 
in fiscal year 2007 under the Infrastructure Protection Program. 
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Objectives 



In response to a legislative mandate and discussions with 
relevant congressional staff, we addressed the following 
questions: 

1 . What methodology did DHS use to allocate HSGP funds for 
fiscal years 2007 and 2008, including any changes DHS 
made to the eligibility and allocation processes for fiscal 
year 2008 and the placement of states and urban areas 
within threat tiers, and why? 

2. How reasonable is DHS's methodology? 
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Scope and Methodology 



We analyzed DHS documents including the FY2007 and FY2008 risk analysis models, 
grant guidance, presentations, and interviewed DHS officials about: 

• The HSGP grant determination process in FY07 — and any changes to the 
FY08 process — including: 

• The process by which DHS's risk analysis model is used to estimate 
relative risk: Risk = Threat*(Vulnerability & Consequences); 

• How the effectiveness assessment process is conducted; 

• How final allocation decisions are made. 

• DHS's methodology for ranking grantees by tiered groups and the impact of this 
ranking on funding allocations. 

We did our work from September 2007 and February 2008, in accordance with 
generally accepted government accounting standards (GAGAS). 
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Background: 



We've reviewed this program for the last 3 years. In previous 
reviews we reported: 

• DHS has adopted a process of "continuous improvement" to 
its methods for estimating risk and measuring applicants' 
effectiveness. 



Inherent uncertainty is associated with estimating risk of 
terrorist attack, requiring the application of policy and analytic 
judgments. The use of sensitivity analysis can help to gauge 
what effects key sources of uncertainty have on outcomes. 



Page 32 



GAO-08-852 Homeland Security 



Appendix I: Briefing for Congressional 
Committees, February 11-25, 2008 



L GAP 

Accountability * Integrity * Reliability 



Results in Brief 



This year, in our review of DHS's allocation 
methodology, we found: 



For FY 2008, DHS is using the same 3-step process - Risk 
Analysis, Effectiveness Assessment, and Final Allocation 
decisions - that includes empirical analytical methods and policy 
judgments, to select eligible urban areas and allocate SHSP and 
UASI funds. 

Generally, DHS has constructed a reasonable methodology to 
assess risk and effectiveness and allocate funds within that given 
year. However, DHS could take an additional step to evaluate the 
reliability and validity of the peer review process. 
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Overview of the Grant Determination Process 
for UASI and SHSP for FY 2007 and FY 2008. 



In both years, DHS applied a 3-step process-using empirical 

analytical methods and policy judgments-to select eligible urban 
areas and allocate SHSP and UASI funds: 

1 . Use of a Risk Analysis formula - R = T*(V&C) - with the 
same indices and weights-except for the Population Index 
used. 



2. Implementation of an Effectiveness Assessment, including a 
peer review process, to assess and score the effectiveness of 
the proposed investments submitted by the eligible applicants. 

3. Calculation of a Final Allocation of funds based on states 
and urban areas' risk scores as adjusted by their 
effectiveness scores. 
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Overview of the Grant Allocation Methodology 
for UASI and SHSG 



Phase 1 : Risk analysis 



Relative risk 
estimate 



Cutoff 
point 




1 10 20 30 40 50 60 70 
Number of urban areas 



Risk estimator 



R=Tx(V&C) 



Relative risk 
estimate 




5 10 15 20 25 30 35 40 45 (56) 
Number of states and territories 



Phase 2: Effectiveness assessment ■Phase 3: Final allocation 



Effectiveness/risk matrix 



Peer review 
of Investment 
Justifications 




$ $ 

$ « $ *^ 



Effectiveness score -t 



Effectiveness/risk matrix 




$ <fc 

$ * $ ^ 



4 i 



Effectiveness score-*- 
Statutory minimum = .375% 



Source: GAO analysis of DHS documents and information provided in interviews. 

a FY 2008 statutory minimum = 0.375% of all funds appropriated for SHSP and UASI. 
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Risk Analysis: DHS's Model Used in 
Determining Relative Risk Scores 



Risk = 



Threat Index 
T 



Data: On-going plot lines, 

credible reporting, relevant 
investigations to create 
threat tiers 

Source: DHS Chief Intelligence 
Officer, intelligence 
community data 




5% 

National Security Index 
National Infrastructure Index 
Threat Index 

Economic Index 
Population Index 



Vulnerability and Consequence Index 
V&C = (P+E+l+N) 



Population Index (P) 

Data: Total population (nighttime, 
commuter, visitor, military 
dependent) and population 
density (constrained to 
50 percent impact) 

Source: Census, LandScan, 

Smith Travel, and DOD 



National Infrastructure Index (I) 

Data: # Tier I Assets (x3) + 

#Tier II Assets 
Source: DHS/OIP, SSAs, States 



1_ 



Economic Index (E) 

Data: Gross Metropolitan Product 
(UASIJ/percent GDP (state 
analysis) 

Source: Global Insight/Department 
ot Commerce, Bureau of 
Economic Statistics 



National Security Index (N) 

Data: Presence of Military Bases 
(yes/no) + # DIB + # intnl 
border crossings 
Source: DOD, DHS/CBP 
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Risk Analysis Model: Calculating Threat 



Threat IndGX - Reflects the Intelligence Community's best assessment of 
areas of the country and potential targets most likely to be attacked. 

• According to DHS officials, for FY2007 and FY2008, the DHS calculated 
the threat index by: 

1 . Collecting qualitative threat information having a nexus with 
international terrorism or its affiliates (and not, for example, domestic 
terrorists or separatist groups); 

2. Analyzing the threat information to create threat assessments for 
states and urban areas; 

3. Empanelling intelligence experts to review the threat assessments and 
reach consensus as to the number of threat tiers and the placement of 
urban areas within threat tiers; and 

4. Assigning threat scores to states and each urban area based on their 
threat tier placement. 
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Risk Analysis Model: Calculating Threat 
(continued) 

DHS /HITRAC officials characterized the general approach to 

measuring threat as empanelling senior intelligence experts who: 

• Consider threat information in four categories - detainee reporting, 
ongoing plot lines, credible reporting, and relevant investigations; 
and 

• Use analytical judgment and discussion to reach consensus as to 
the number of threat tiers and the placement of urban areas within 
threat tiers. 

• According to DHS officials, final threat assessments are approved 
by the Intelligence Community -- FBI, CIA, NCTC, DIA, the DHS 
Undersecretary of l&A and the Secretary of DHS. 
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Risk Analysis Model: Calculating Threat 
(continued) 



This general approach has no written criteria, and DHS program 
officials expressed concerns about their confidence in the existing 
threat information. 



• The threat tiering system is a method for organizing the threat 
information for the grant risk calculation model. The application of 
threat data to the risk determination methodology is process of 
assigning numbers to qualitative data according to DHS officials. 



• Given their concerns about the available threat data, DHS officials 
expressed limited confidence in the formula's ability to adequately 
represent threat (T). 

• Consequently, threat has a weight of only 20% in the model used to 
determine relative risk. 
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Risk Analysis Model: Calculating Vulnerability 
& Consequence (V&C) 

• Population Index: this variable included nighttime population and military dependant 
populations for states and urban areas, based upon U.S. Census Bureau and Department of Defense 
inputs. In addition, for urban areas, population density, commuters, and visitors were also factored into 
this variable, using data from private entities. 

• National Infrastructure Index: this variable focused on approximately 2,100 Tier I 

and Tier II critical infrastructure/key resource (CI/KR) assets that were identified by the DHS Office of 
Infrastructure Protection. Tier I assets or systems are those that if attacked could trigger major national 
or regional impacts similar to those experienced during Hurricane Katrina or 9/1 1 . Tier II assets are 
other highly-consequential assets with potential national or regional impacts if attacked. 

• Economic Index: this variable considered the economic value of the goods and services 
produced in either a state or an urban area. For states, this index was calculated using U.S. 
Department of Commerce data on their percentage contribution to Gross Domestic Product. For UASI 
urban areas, a parallel calculation of Gross Metropolitan Product was incorporated based on data from 
Global Insight. 

• National Security Index: this variable considered the presence of three key national 
security factors: whether military bases are present in the state or urban area; how many critical 
defense industrial base facilities are located in the state or urban area; and the total number of people 
traversing international borders. Information on these inputs comes from the Department of Defense 
and DHS. 
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Risk Analysis Model: Measuring Vulnerability 
& Consequence (continued) 

Population Index - 

• For FY 2007, Urban Areas were defined as: Center city boundary +1 0-mile 
radius. 

• For FY 2008, DHS used Metropolitan Statistical Areas (MSAs) from the 
Census Bureau, as provided under the Implementing Recommendations of 
the 9/1 1 Commission Act of 2007. a 

• Consequently, there were a number of changes in the rankings that were 
driven by the required change in FY2008 to use the MSAs, according to 
DHS officials. 

a 6U.S.C. §601(5). 
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Risk Analysis Model: Measuring Vulnerability 
& Consequence (continued) 



National Infrastructure Index - 



Critical infrastructure assets are divided into 2 tiers that, if destroyed or disrupted, 
could cause significant casualties, major economic losses, or widespread/long-term 
disruptions to national well-being and governance capacity. 

Tier 2 includes the nation's highest consequence critical infrastructure and key 
resources across 17 sectors. 



• Tier 1 is a small subset of Tier 2 and includes the most nationally significant 
assets/systems certain to produce at least two of four consequences: 

1 . Prompt fatalities greater than 5,000; 

2. First-year economic impact of at least $75 billion; 

3. Mass evacuations with prolonged (6 months or more) absence; 

4. Loss of governance or mission execution disrupting multiple regions or critical 
infrastructure sectors for more than a week, resulting in a loss of necessary 
services to the public. 
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National Infrastructure Index - 
Asset Identification Process 

According to DHS, it used a collaborative, multi-step process to create the 
Tier 2 asset list 

Step 1: DHS's Infrastructure Protection office (IP) works with sector-specific 
agencies (SSAs) to develop criteria used to determine which assets should be 
placed in a threat tier 

Step 2: The criteria is vetted with private-sector companies through sector- 
specific councils who review the criteria and provide feedback to IP 

Step 3: IP finalizes the criteria list and provides the list to the sector-specific 
agencies 

Step 4: IP asks states to nominate assets within their jurisdiction that match the 
criteria 

Step 5: Nominated assets are reviewed by IP and the SSAs to decide which 
assets comprise the final Tier 2 list 

IP has recently added a new process so SSAs can resubmit for 
reconsideration assets that are not initially selected for the list. 
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Sensitivity of the risk analysis 



In FY 2007, DHS had developed a greater understanding of the 
sensitivity of the risk model as a result of its changes to the model. 

GAO's analysis of the FY 2007 model: 

• It takes sizable changes to the weights of these indices used to 
quantify risk to change the areas that compose the Tier 1 list. 

• For those urban areas ranked near the bottom of Tier 2 list, very 
small changes in the weights for the indices used to quantify risk 
can result in changes in eligibility. 

According to DHS officials, there were a number of changes in the 
rankings, and these changes were driven by the required change in 
FY2008 to use MSAs. 
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Effectiveness Assessment 



For fiscal year 2007 DHS assessed the applications submitted by 
states and eligible urban areas. 

DHS used a peer-review process to assess and score the 
effectiveness of proposed investments by: 

• Engaging the states in identifying and selecting peer 
reviewers, 

• Having peer reviewers individually score investments, and 

• Assigning peer reviewers to panels to make final effectiveness 
score determinations. 
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FY 2007 Effectiveness Assessment 



c 



Effectiveness score 

(100 points) 



Portfolio score 

(20 points) 



Multi-applicant investment bonus 

where applicable 
(up to 8 points) 



Average of investment scores 

1 up to 15 K 

(80 points) 




I— I 



Investment scores 



J 



Comprehensive 
investment score 

(80 points) 



1 



Investment 
categories score 

(80 points) 



Published in 
fiscal year 
2007 HSGP 

grant 
guidance 



X 



Strategy 

(15%) 



Milestones 

(10%) 





Impact 






(10%) 




V 







Investment 
challenges 

(5%) 



Program 
management 

(25%) 



Impact 

(35%) 



Source: DHS. 
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Effectiveness Assessment: Peer Review Process 
Quality Assurance and Inter-rater Reliability 

As a quality control step, DHS analyzed the results of the peer review 
process to assess whether the process was affected by human 
bias. 

• DHS analyzed all FY 2007 panels' scores and found no panel's 
average was more than 2 standard deviations from the mean. 

• DHS concluded, from this finding, that their peer review process 
adequately mitigated human bias. 

However, based on GAO's review of DHS documentation, the 
analysis DHS used did not apply a generally-accepted method to 
ensure inter-rater reliability. 

• One way to effectively assess the potential for human bias is to 
have a sample of the same applications independently rated by 
multiple panels to provide a measure of inter-rater reliability. 
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Final Allocation Process - FY 2007 Grants 
Based on Both Risk and Effectiveness Scores 

DHS allocated funds based on the risk scores of states and urban areas, as 
adjusted by their effectiveness scores. 

SHSP provided a minimum allocation, ensuring no state or territory's allocation 
falls below the minimum levels established by the USA PATRIOT Act.* 

For UASI, DHS established maximum and minimum allocation to minimize 
variations in some urban areas' final allocations between years. 



a For FY2007 this minimum was 0.75 percent of funds appropriated for SHSP for states and 0.25 percent for territories. FY 2008 statutory 
minimum = 0.375% of all funds appropriated for SHSP and UASI. 
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Final Allocation Process - Ranking UASI 
Grantees by Tiered groups 

• Fiscal year 2007, 45 eligible candidates were grouped into 
two tiers according to relative risk. 

• Tiering was established from a policy judgment by DHS 
leadership, according to DHS grant officials. 

• Tier I included the 6 highest risk areas; Tier II included the 
other 39 candidate areas ranked by risk. 

• FY 2007 Tier I Urban Areas = 6 Urban Areas, 
$410,795,000 allocated (55 percent of available funds). 

• FY 2007 Tier II Urban Areas = 39 Urban Areas, 
$336,105,000 allocated (45 percent of available funds). 
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Final Allocation Process — Risk Estimates Used to Inform 

Eligibility Decisions for the UASI Grant Program — Fiscal Year 2008 



60 eligible UASI areas in FY 2008: 

• Tier I = 7 highest risk areas and eligible for 55 percent of 
available funds -- $429,896,500. 

• Tier II = 53 areas (14 more than FY 2007) and eligible for 45 
percent of available funds -- $351 ,733,500. 

According to DHS officials, the expansion to 60 eligible UASI 
areas for FY2008 is a policy decision largely driven by two 
factors: 

1 . The new requirement that FEMA use MSAs; 

2. The desire to remain consistent with the funding. 
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Observations on the Reasonableness of the 
HSGP Grant Distribution Methodology 

As inherent uncertainty is always associated with estimating 
risk of terrorist attack, policy and analytic judgments are v 
required. 

DHS has adopted an overall risk assessment approach that 
consists of risk factors, and in implementing this approach 
has made judgments in an attempt to address inherent 
uncertainties. 

Generally, DHS has constructed a reasonable methodology to 
assess risk and effectiveness and allocate funds within that 
given year. 
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Observations on the Reasonableness of the HSGP 
Grant Distribution Methodology (continued) 

DHS could take an additional step to evaluate the reliability and 
validity of the peer review process. 

• One way to effectively assess the potential for human 
bias is to have a sample of the same applications 
independently rated by multiple panels to provide a 
measure of inter-rater reliability. 

• DHS identified resource constraints as a reason for not 
measuring inter-rater reliability. 
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As we reported in 2007, DHS first had to determine the geographic 
boundaries or footprint of candidate urban areas within which data were 
collected to estimate risk in order to determine the urban areas that were 
eligible to receive UASI grants,. In fiscal year 2005, the footprint was 
limited to city boundaries (and did not include the 10-mile buffer zone). 
DHS chose to further redefine the footprint for fiscal year 2006, on the 
basis of comments from state and local governments. DHS took several 
steps to identify this footprint; these included: 

• Identifying areas with population greater than 100,000 persons and areas 
(cities) that had any reported threat data during that past year. For fiscal 
year 2006, DHS started with a total of 266 cities. 

• Combining cities or adjacent urban counties with shared boundaries to 
form single jurisdictions. For fiscal year 2006, this resulted in 172 urban 
areas. 

Drawing a buffer zone around identified areas. A 10-mile buffer was then 
drawn from the border of that city/combined entity to establish candidate 
urban areas. 1 This area was used to determine what information was used 
in the risk analysis, and represents the minimum area that had to be part 
of the state/urban areas defined grant application areas. 

According to DHS, for fiscal year 2006, it considered other alternatives 
such as a radius from a city center, although such a solution created 
apparent inequities among urban areas. DHS incorporated buffer zones at 
the suggestion of stakeholders, although this action resulted in making the 
analysis more difficult, according to a DHS official. In addition, DHS 
officials told us the steps taken to determine the footprint were based on 
the "best fit," as compared with other alternatives. DHS did not provide 
details on what criteria this comparison was based on. 

A principal change between fiscal year 2007 and 2008 was the method 
used to identify the footprint, or boundaries, of UASI areas for the 
purposes of calculating relative risk. In fiscal year 2008, DHS used 
Metropolitan Statistical Areas (MSAs) from the Census Bureau, as required 



1 Buffer zone extensions were considered for chemical plants (25 miles) and nuclear power 
plants (50 miles). According to DHS officials, these distances were selected based on 
plume effects influenced by research conducted by the Department of Energy. 
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under the Implementing Recommendations of the 9/11 Commission Act of 
2007. 2 

Table 1 below provide additional information listing the urban areas by its 
prior geographic area captures, and the areas captured by MSAs. 



Table 1 : Urban Areas Eligible for UASI Grants: Fiscal Year 2006 Footprint vs. 2008 by Metropolitan Statistical Areas (New 
UASI grantees are in italics) 



Eligible urban area / Geographic area captured 

State in the data count Metropolitan Statistical Areas used in FY2008" 

AZ Phoenix Area: Phoenix-Mesa-Scottsdale, AZ Metropolitan Statistical Area 

Chandler, Gilbert, Glendale, Mesa, Peoria, Phoenix, Principal Cities: Phoenix, Mesa, Scottsdale, Tempe; Maricopa County, 

Scottsdale, Tempe, and a 10-mile buffer extending Pinal County, 
from the border of the combined area. 



Tucson, AZ Metropolitan Statistical Area Principal City: Tucson; Pima 
County 

CA Anaheim /Santa Ana Area: Santa Ana-Anaheim-Irvine, CA Metropolitan Division Orange County . 

Anaheim, Costa Mesa, Garden Grove, Fullerton, 
Huntington Beach, Irvine, Orange, Santa Ana, and 
a 10-mile buffer extending from the border of the 
combined area. 

Los Angeles /Long Beach Area: 

Burbank, Glendale, Inglewood, Long Beach, Los 
Angeles, Pasadena, Santa Monica, Santa Clarita, 
Torrance, Simi Valley, Thousand Oaks, and a 10- 
mile buffer extending from the border of the 
combined area. 



Los Angeles-Long Beach-Santa Ana, CA Metropolitan Statistical Area 

Principal Cities: Los Angeles, Long Beach, Glendale, Irvine, Pomona, 
Pasadena, Torrance, Orange, Fullerton, Costa Mesa, Burbank, 
Compton, Carson, Santa Monica, Newport Beach, Tustin, Montebello, 
Monterey Park, Gardena, Paramount, Fountain Valley, Arcadia, Cerritos 
Los Angeles-Long Beach-Glendale, CA Metropolitan Division Los 
Angeles County. 



Sacramento Area : Sacramento— Arden-Arcade — Roseville, CA Metropolitan Statistical 

Elk Grove, Sacramento, and a 10-mile buffer Area 

extending from the border of the combined area. Principal Cities: Sacramento, Arden-Arcade, Roseville, Folsom, Rancho 

Cordova, Woodland; El Dorado County, Placer County, Sacramento 
County, Yolo County. 



San Diego Area: San Diego-Carlsbad-San Marcos, CA Metropolitan Statistical Area 

Chula Vista, Escondido, and San Diego, and a 10- Principal Cities: San Diego, Carlsbad, San Marcos, National City; San 

mile buffer extending from the border of the Diego County, 
combined area. 



2 6 U.S.C. § 601(5). 
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State 



Eligible urban area / Geographic area captured 
in the data count 



Metropolitan Statistical Areas used in FY2008 8 



Bay Area: 

Berkeley, Daly City, Fremont, Hayward, Oakland, 
Palo Alto, Richmond, San Francisco, San Jose, 
Santa Clara, Sunnyvale, Vallejo, and a 10-mile 
buffer extending from the border of the combined 
area. 



San Francisco-San Jose-Bay Area: 

San Francisco-Oakland-Fremont, CA Metropolitan Statistical Area 

Principal Cities: San Francisco, Oakland, Fremont, Hayward, Berkeley, 
San Mateo, San Leandro, Redwood City, Pleasanton, Walnut Creek, 
South San Francisco, San Rafael; Oakland-Fremont-Hayward, CA 
Metropolitan Division Alameda County, Contra Costa County; San 
Francisco-San Mateo-Redwood City, CA Metropolitan Division; Marin 
County, San Francisco County, San Mateo County; San Jose- 
Sunnyvale-Santa Clara, CA Metropolitan Statistical Area ; Principal 
Cities: San Jose, Sunnyvale, Santa Clara, Mountain View, Milpitas, Palo 
Alto, Cupertino San Benito County, Santa Clara County. 



FY 2008 UASI area - Riverside -San Bernardino-Ontario, CA 
Metropolitan Statistical Area 

Principal Cities: Riverside, San Bernardino, Ontario, Victorville, 
Temecula, Chino, Redlands, Hemet, Colton; Riverside County, San 
Bernardino County. 



CO Denver Area: Denver-Aurora, CO Metropolitan Statistical Area 

Arvada, Aurora, Denver, Lakewood, Westminster, Principal Cities: Denver, Aurora; Adams County, Arapahoe County, 

Thornton, and a 10-mile buffer extending from the Broomfield County, Clear Creek County, Denver County, Douglas 

border of the combined area. County, Elbert County, Gilpin County, Jefferson County, Park County. 



CT FY 2008 UASI area - Hartford -West Hartford-East Hartford, CT 

Metropolitan Statistical Area 

Principal Cities: Hartford, West Hartford, East Hartford, Middletown; 
Hartford County, Middlesex County, Tolland County. 



FY 2008 UASI area — Bridgeport-Stamford-Norwalk, CT Metropolitan 
Statistical Area 

Principal Cities: Bridgeport, Stamford, Norwalk, Danbury, Stratford; 
Fairfield County. 
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Eligible urban area / Geographic area captured 
in the data count 



Metropolitan Statistical Areas used in FY2008 8 



DC National Capital Region: 

National Capital Region and a 10-mile buffer 
extending from the border of the combined area. 



Washington-Arlington-Alexandria, DC-VA-MD-WV Metropolitan 
Statistical Area 

Principal Cities: Washington, DC; Arlington, VA; Alexandria, VA; Reston, 
VA; Bethesda, MD; Gaithersburg, MD; Frederick, MD; Rockville, MD 
Bethesda-Gaithersburg-Frederick, MD Metropolitan Division Frederick 
County, Montgomery County; Washington-Arlington-Alexandria, DC-VA- 
MD-WV Metropolitan Division District of Columbia, DC; Calvert County, 
MD; Charles County, MD; Prince George's County, MD; Arlington 
County, VA; Clarke County, VA; Fairfax County, VA; Fauquier County, 
VA; Loudoun County, VA; Prince William County, VA; Spotsylvania 
County, VA; Stafford County, VA; Warren County, VA; Alexandria city, 
VA; Fairfax city, VA; Falls Church city, VA; Fredericksburg city, VA; 
Manassas city, VA; Manassas Park city, VA; Jefferson County, WV. 



FL 



Fort Lauderdale Area: 

Fort Lauderdale, Hollywood, Miami Gardens, 
Miramar, Pembroke Pines, and a 10-mile buffer 
extending from the border of the combined area. 



Fort Lauderdale-Pompano Beach, FL Metropolitan Statistical Area 

Principal Cities: Fort Lauderdale, West Palm Beach, Pompano Beach, 
Boca Raton, Deerfield Beach, Boynton Beach, Delray Beach; Broward 
County, Palm Beach, County. 



Jacksonville Area: Jacksonville, FL Metropolitan Statistical Area 

Jacksonville and a 10-mile buffer extending from Principal City: Jacksonville; Baker County, Clay County, Duval County, 
the city border. Nassau County, St. Johns County. 



Miami Area: Miami, FL Metropolitan Statistical Area 

Hialeah, Miami, and a 10-mile buffer extending from Principal Cities: Miami, Miami Beach, Kendall; Monroe County, Miami- 
the border of the combined area. Dade. County. 



Orlando Area: Orlando-Kissimmee, FL Metropolitan Statistical Area 

Orlando and a 10-mile buffer extending from the city Principal Cities: Orlando, Kissimmee; Lake County, Orange County, 
border. Osceola County, Seminole County. 



Tampa Area: Tampa-St. Petersburg-Clearwater, FL Metropolitan Statistical Area 

Clearwater, St. Petersburg, Tampa, and a 10-mile Principal Cities: Tampa, St. Petersburg, Clearwater, Largo; Hernando 

buffer extending from the border of the combined County, Hillsborough County, Pasco County, Pinellas County, 
area. 
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Eligible urban area / Geographic area captured 
State in the data count Metropolitan Statistical Areas used in FY2008 8 

GA Atlanta Area: Atlanta-Sandy Springs-Marietta, GA Metropolitan Statistical Area 

Atlanta and a 10-mile buffer extending from the city Principal Cities: Atlanta, Sandy Springs, Marietta; Barrow County, 
border. Bartow County, Butts County, Carroll County, Cherokee County, Clayton 

County, Cobb County, Coweta County, Dawson County, DeKalb County, 
Douglas County, Fayette County, Forsyth County, Fulton County, 
Gwinnett County, Haralson County, Heard County, Henry County, 
Jasper County, Lamar County, Meriwether County, Newton County, 
Paulding County, Pickens County, Pike County, Rockdale County, 
Spalding County, Walton County. 



HI Honolulu Area: 

Honolulu and a 10-mile buffer extending from the 
city border. 



Honolulu, HI Metropolitan Statistical Area 
Principal City: Honolulu Honolulu County 



IL Chicago Area: 

Chicago and a 10-mile buffer extending from the 
city border. 



Chicago-Naperville-Joliet, IL-IN-WI Metropolitan Statistical Area 

Principal Cities: Chicago, IL; Naperville, IL; Joliet, IL; Gary, IN; Elgin, IL; 
Arlington Heights, IL; Evanston, IL; Schaumburg, IL; Skokie, IL; Des 
Plaines, IL; Hoffman Estates, IL ; Chicago-Naperville-Joliet, IL 
Metropolitan Division; Cook County, DeKalb County, DuPage County, 
Grundy County, Kane County, Kendall County, McHenry County, Will 
County ,Gary, IN Metropolitan Division Jasper County, Lake County, 
Newton County, Porter County Lake County-Kenosha County, IL-WI 
Metropolitan Division Lake County, IL; Kenosha County, Wl. 



IN Indianapolis Area: Indianapolis-Carmel, IN Metropolitan Statistical Area 

Indianapolis and a 10-mile buffer extending from the Principal City: Indianapolis city (balance), 3 Carmel; Boone County, 
city border. Brown County, Hamilton County, Hancock County, Hendricks County, 

Johnson County, Marion County, Morgan County, Putnam County, 

Shelby County. 



3 Indianapolis (balance) refers to the portion of the consolidated government of 
Indianapolis city and Marion County minus the separately incorporated places of Clermont, 
Crows Nest, Cumberland, Homecroft, Meridian Hills, North Crows Nest, Rocky Ripple, 
Spring Hill, Warren Park, Williams Creek, and Wynnedale within the consolidated city. It 
excludes the cities of Beech Grove, Lawrence, Southport, and Speedway which are within 
Marion County, but are not part of the consolidated city. 
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KY Louisville Area: 

Louisville and a 10-mile buffer extending from the 
city border. 



FY 2008 UASI area — Louisville/Jefferson County, KY-IN Metropolitan 
Statistical Area Principal City: Louisville/Jefferson County (balance), 
KY, 4 Clark County, IN; Floyd County, IN; Harrison County, IN; 
Washington County, IN; Bullitt County, KY; Henry County, KY; Jefferson 
County, KY; Meade County, KY; Nelson County, KY; Oldham County, 
KY; Shelby County, KY; Spencer County, KY; Trimble County, KY. 



LA Baton Rouge Area: 

Baton Rouge and a 10-mile buffer extending from 
the city border. 



FY 2008 UASI area — Baton Rouge, LA 
Metropolitan Statistical Area 

Principal City: Baton Rouge; Ascension Parish, East Baton Rouge 
Parish, East Feliciana Parish, Iberville Parish, Livingston Parish, Pointe 
Coupee Parish, St. Helena Parish, West Baton Rouge Parish, West 
Feliciana Parish. 



New Orleans Area: New Orleans-Metairie-Kenner, LA Metropolitan Statistical Area 

New Orleans and a 10-mile buffer extending from Principal Cities: New Orleans, Metairie, Kenner; Jefferson Parish, 
the city border. Orleans Parish, Plaquemines Parish, St. Bernard Parish, St. Charles 

Parish, St. John the Baptist Parish, St. Tammany Parish. 



MA Boston Area: Boston-Cambridge-Quincy, MA-NH Metropolitan Statistical Area 

Boston, Cambridge, and a 10-mile buffer extending Principal Cities: Boston, MA; Cambridge, MA; Quincy, MA; Newton, MA; 

from the border of the combined area. Framingham, MA; Waltham, MA; Peabody, MA Boston-Quincy, MA 

Metropolitan Division; Norfolk County, Plymouth County, Suffolk County 
Cambridge-Newton-Framingham, MA Metropolitan Division Middlesex 
County, Peabody, MA Metropolitan Division Essex County Rockingham 
County-Strafford County, NH Metropolitan Division Rockingham County, 
Strafford County. 



MD Baltimore Area: Baltimore-Towson, MD Metropolitan Statistical Area 

Baltimore and a 10-mile buffer extending from the Principal Cities: Baltimore, Towson; Anne Arundel County, Baltimore 
city border. County, Carroll County, Harford County, Howard County, Queen Anne's 

County, Baltimore city. 



4 Louisville/Jefferson County (balance) refers to the portion of the consolidated 
government of Louisville city and Jefferson County minus the separately incorporated 
places. For a complete listing of jurisdictions, see OMB Bulletin No. 07-01, page 39 
(Washington, DC. Dec. 16, 2006). 
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Ml Detroit Area: 

Detroit, Sterling Heights, Warren, and a 10-mile 
buffer extending from the border of the combined 
area. 



Detroit-Warren-Livonia, Ml Metropolitan Statistical Area Principal Cities: 
Detroit, Warren, Livonia, Dearborn, Troy, Farmington Hills, Southfield, 
Pontiac, Taylor, Novi Detroit-Livonia-Dearborn, Ml Metropolitan Division; 
Wayne County, Warren-Troy-Farmington Hills, Ml Metropolitan Division 
Lapeer County, Livingston County, Macomb County, Oakland County, 
St. Clair County. 



MN Twin Cities Area: Minneapolis-St. Paul-Bloomington, MN-WI Metropolitan Statistical Area 

Minneapolis, St. Paul, and a 10-mile buffer Principal Cities: Minneapolis, MN; St. Paul, MN; Bloomington, MN; 

extending from the border of the combined entity. Plymouth, MN; Eagan, MN; Eden Prairie, MN; Minnetonka, MN; Anoka 

County, MN; Carver County, MN; Chisago County, MN; Dakota County, 

MN; Hennepin County, MN; Isanti County, MN; Ramsey County, MN; 

Scott County, MN; Sherburne County, MN; Washington County, MN; 

Wright County, MN; Pierce County, Wl; St. Croix County, Wl. 



MO Kansas City Area: 

Independence, Kansas City (MO), Kansas City 
(KS), Olathe, Overland Park, and a 10-mile buffer 
extending from the border of the combined area. 



Kansas City, MO-KS Metropolitan Statistical Area D 

Principal Cities: Kansas City, MO, Overland Park, KS, Kansas City, KS 
Franklin County, KS; Johnson County, KS; Leavenworth County, KS; 
Linn County, KS; Miami County, KS; Wyandotte County, KS; Bates 
County, MO; Caldwell County, MO; Cass County, MO; Clay County, MO; 
Clinton County, MO; Jackson County, MO; Lafayette County, MO; Platte 
County, MO; Ray County, MO. 



St. Louis Area: St. Louis, MO-IL Metropolitan Statistical Area 

St. Louis and a 10-mile buffer extending from the Principal Cities: St. Louis, MO; St. Charles, MO; Bond County, IL; 
city border. Calhoun County, IL; Clinton County, IL; Jersey County, IL; Macoupin 

County, IL; Madison County, IL; Monroe County, IL; St. Clair County, IL; 

Crawford County, MO (part — Sullivan city); 7 Franklin County, MO; 

Jefferson County, MO; Lincoln County, MO; St. Charles County, MO; St. 

Louis County, MO; Warren County, MO; Washington County, MO; St. 

Louis city, MO. 



The title is pursuant to P.L. 98-369, Section 611 (July 18, 1984); all counties specified in 
that legislation, plus five additional counties, qualify under the 2000 standards and are 
included in the definition of the Kansas City, MO-KS Metropolitan Statistical Area. 

6 The title and definition reflect the provisions of P.L. 98-473, Section 119A (October 12, 
1984), plus six additional counties that qualify under the 2000 standards. 

7 Pursuant to P.L. 100-202, Section 530, the part of Sullivan city in Crawford County, MO 
was added to the St. Louis, MO-IL Metropolitan Statistical Area effective December 22, 
1987. 
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NC Charlotte Area: 

Charlotte and a 10-mile buffer extending from the 
city border. 



Charlotte-Gastonia-Concord, NC-SC Metropolitan Statistical Area 

Principal Cities: Charlotte, NC; Gastonia, NC; Concord, NC, Rock Hill, 
SC; Anson County, NC; Cabarrus County, NC; Gaston County, NC; 
Mecklenburg County, NC; Union County, NC; York County, SC. 



NJ Jersey City/Newark Area: Newark Metropolitan Statistical Area 

Elizabeth, Jersey City, Newark, and a 10-mile buffer Principal Cities: Newark, Edison, Union, Wayne; Bergen County, Essex 
extending from the border of the combined area. County, Hudson County, Hunterdon County, Middlesex County, 

Monmouth County, Morris County, Ocean County, Passaic County, 

Somerset County, Sussex County , Union County , Pike County (PA). 8 



NV Las Vegas Area: Las Vegas-Paradise, NV Metropolitan Statistical Area 

Las Vegas, North Las Vegas, and a 10-mile buffer Principal Cities: Las Vegas, Paradise; Clark County, 
extending from the border of the combined entity. 



NY FY 2008 UASI area — Albany-Schenectady-Troy, NY Metropolitan 

Statistical Area 

Principal Cities: Albany, Schenectady, Troy; Albany County, Rensselaer 
County, Saratoga County, Schenectady County, Schoharie County. 



Buffalo Area: Buffalo-Niagara Falls, NY Metropolitan Statistical Area 

Buffalo and a 10-mile buffer extending from the city Principal Cities: Buffalo, Cheektowaga, Tonawanda, Niagara Falls; Erie 
border. County, Niagara County. 



New York City Area: New York-Long Island, NY — Metropolitan Statistical Area Principal 

New York City, Yonkers, and a 10-mile buffer Cities: New York White Plains; Bronx County, Kings County .Nassau 

extending from the border of the combined area. bounty, New York County, Putnam County Queens County, Richmond 

County, Rockland County, Suffolk County, Westchester County. 

FY 2008 UASI area — Rochester, NY Metropolitan Statistical Area 

Principal City: Rochester; Livingston County, Monroe County, Ontario 
County, Orleans County, Wayne County. 



FY 2008 UASI area — Syracuse, NY Metropolitan Statistical Area 

Principal City: Syracuse; Madison County, Onondaga County, Oswego 
County. 



According to FEMA, for the purposes of DHS' risk analysis, a policy decision was made to 
utilize the metropolitan division lines to parse out the New Jersey metropolitan divisions 
from the NYC MSA. The NJ metropolitan divisions of the NYC MSA were attributed to the 
Newark MSA. 
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OH Cincinnati Area: Cincinnati-Middletown, OH-KY-IN Metropolitan Statistical Area 

Cincinnati and a 10-mile buffer extending from the Principal Cities: Cincinnati, OH; Middletown, OH; Dearborn County, IN; 
city border. Franklin County, IN; Ohio County, IN; Boone County, KY; Bracken 

County, KY; Campbell County, KY; Gallatin County, KY; Grant County, 

KY; Kenton County, KY; Pendleton County, KY; Brown County, OH; 

Butler County, OH; Clermont County, OH; Hamilton County, OH; Warren 

County, OH. 



Cleveland Area: Cleveland-Elyria-Mentor, OH Metropolitan Statistical Area 

Cleveland and a 10-mile buffer extending from the Principal Cities: Cleveland, Elyria, Mentor; Cuyahoga County, Geauga 
city border. County, Lake County, Lorain County, Medina County. 



Columbus Area: Columbus, OH Metropolitan Statistical Area 

Columbus and a 10-mile buffer extending from the Principal City: Columbus; Delaware County, Fairfield County, Franklin 
city border. County, Licking County, Madison County, Morrow County, Pickaway 

County, Union County. 



Toledo Area: FY 2008 UASI area — Toledo, OH Metropolitan Statistical Area 

Oregon, Toledo, and a 10-mile buffer extending Principal City: Toledo; Fulton County, Lucas County, Ottawa County, 
from the border of the combined area. Wood County. 



OK Oklahoma City Area: Oklahoma City, OK Metropolitan Statistical Area 

Norman, Oklahoma City, and a 10-mile buffer Principal City: Oklahoma City; Canadian County, Cleveland County, 

extending from the border of the combined area. Grady County, Lincoln County, Logan County, McClain County, 

Oklahoma County. 



OR Portland Area: Portland-Vancouver-Beaverton, OR-WA Metropolitan Statistical Area 

Portland, Vancouver, and a 10-mile buffer Principal Cities: Portland, OR; Vancouver, WA; Beaverton, OR; 

extending from the border of the combined area. Hillsboro, OR; Clackamas County, OR; Columbia County, OR; 

Multnomah County, OR; Washington County, OR; Yamhill County, OR; 

Clark County, WA; Skamania County, WA. 



PA Philadelphia Area: 

Philadelphia and a 10-mile buffer extending from 
the city border. 



Philadelphia-Camden-Wilmington, PA-NJ-DE-MD Metropolitan 
Statistical Area 

Principal Cities: Philadelphia, PA; Camden, NJ; Wilmington, DE 
Camden, NJ Metropolitan Division; Burlington County, Camden County, 
Gloucester County 37964 Philadelphia, PA Metropolitan Division Bucks 
County, Chester County, Delaware County, Montgomery County, 
Philadelphia County Wilmington, DE-MD-NJ Metropolitan Division New 
Castle County, DE; Cecil County, MD; Salem County, NJ. 
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Pittsburgh Area: 

Pittsburgh and a 10-mile buffer extending from the 
city border. 



Pittsburgh, PA Metropolitan Statistical Area 

Principal City: Pittsburgh; Allegheny County, Armstrong County, Beaver 
County, Butler County, Fayette County, Washington County, 
Westmoreland County. 



PR FY 2008 UASI area — San Juan-Caguas-Guaynabo, PR Metropolitan 

Statistical Area Principal Cities: San Juan, Caguas, Guaynabo Aguas 
Buenas Municipio, Aibonito Municipio, Arecibo Municipio, Barceloneta 
Municipio, Barranquitas Municipio, Bayamon Municipio, Caguas 
Municipio, Camuy Municipio, Canovanas Municipio, Carolina Municipio, 
Cataho Municipio, Cayey Municipio, Ciales Municipio, Cidra Municipio, 
Comeno Municipio, Corozal Municipio, Dorado Municipio, Florida 
Municipio, Guaynabo Municipio, Gurabo Municipio, Hatillo Municipio, 
Humacao Municipio, Juncos Municipio, Las Piedras Municipio, Loiza 
Municipio, Manati Municipio, Maunabo Municipio, Morovis Municipio, 
Naguabo Municipio, Naranjito Municipio, Orocovis Municipio, 
Quebradillas Municipio, Rio Grande Municipio, San Juan Municipio, San 
Lorenzo Municipio, Toa Alta Municipio, Toa Baja Municipio, Trujillo Alto 
Municipio, Vega Alta Municipio, Vega Baja Municipio, Yabucoa 
Municipio. 



Rl Providence-New Bedford-Fall River, RI-MA Metropolitan Statistical Area 

Principal Cities: Providence, Rl; New Bedford, MA; Fall River, MA; 
Warwick, Rl; Cranston, Rl; Bristol County, MA; Bristol County, Rl; Kent 
County, Rl; Newport County, Rl; Providence County, Rl; Washington 
County, Rl. 



TN Memphis Area: Memphis, TN-MS-AR Metropolitan Statistical Area 

Memphis and a 10-mile buffer extending from the Principal City: Memphis, TN; Crittenden County, AR; DeSoto County, 
city border. MS; Marshall County, MS; Tate County, MS; Tunica County, MS; 

Fayette County, TN; Shelby County, TN; Tipton County, TN. 



FY 2008 UASI area - Nashville -Davidson, Murfreesboro, Franklin, TN 
Metropolitan Statistical Area Principal Cities: Nashville-Davidson 
(balance), 9 Murfreesboro, Franklin; Cannon County, Cheatham County, 
Davidson County, Dickson County, Hickman County, Macon County, 
Robertson County, Rutherford County, Smith County, Sumner County, 
Trousdale County, Williamson County, Wilson County. 



Nashville-Davidson (balance) refers to the portion of the consolidated government of 
Nashville city and Davidson County minus the separately incorporated places of Belle 
Meade, Berry Hill, Forest Hills, Goodlettesville, Lakewood, Oak Hill, and Ridgetop within 
the consolidated city. 
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TX FY 2008 UASI area — Austin-Round Rock, TX Metropolitan Statistical 

Area 

Principal Cities: Austin, Round Rock; Bastrop County, Caldwell County, 
Hays County, Travis County, Williamson County. 



Dallas/Fort Worth/Arlington Area: Dallas-Fort Worth-Arlington, TX Metropolitan Statistical Area 

Arlington, Carrollton, Dallas, Fort Worth, Garland, Principal Cities: Dallas, Fort Worth, Arlington, Piano, Irving, Carrollton, 
Grand Prairie, Irving, Mesquite, Piano, and a 10- Denton, Richardson, McKinney Dallas-Plano-lrving, TX Metropolitan 
mile buffer extending from the border of the Division; Collin County, Dallas County, Delta County, Denton County, 

combined area. Ellis County, Hunt County, Kaufman County, Rockwall County Fort 

Worth-Arlington, TX Metropolitan Division Johnson County, Parker 

County, Tarrant County, Wise County. 



El Paso, TX Metropolitan Statistical Area 
Principal City: El Paso; El Paso County. 



Houston Area: 

Houston, Pasadena, and a 10-mile buffer extending 
from the border of the combined entity. 



Houston-Sugar Land-Baytown, TX Metropolitan Statistical Area Principal 
Cities: Houston, Sugar Land, Baytown, Galveston; Austin County, 
Brazoria County, Chambers County, Fort Bend County, Galveston 
County, Harris County, Liberty County, Montgomery County, San 
Jacinto County, Waller County. 



San Antonio Area: San Antonio, TX Metropolitan Statistical Area 

San Antonio and a 10-mile buffer extending from Principal City: San Antonio; Atascosa County, Bandera County, Bexar 
the city border. County, Comal County, Guadalupe County, Kendall County, Medina 

County, Wilson County. 

UT FY 2008 UASI area — Salt Lake City, UT Metropolitan Statistical Area 

Principal City: Salt Lake City; Salt Lake County, Summit County, Tooele 
County. 



VA FY 2008 UASI area — Richmond, VA Metropolitan Statistical Area 

Principal City: Richmond; Amelia County, Caroline County, Charles City 
County, Chesterfield County, Cumberland County, Dinwiddie County, 
Goochland County, Hanover County, Henrico County, King and Queen 
County, King William County, Louisa County, New Kent County, 
Powhatan County, Prince George County, Sussex County, Colonial 
Heights city, Hopewell city, Petersburg city, Richmond city. 
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Norfolk- Virginia Beach-Newport News, VA-NC Metropolitan Statistical 
Area 

Principal Cities: Virginia Beach, VA; Norfolk, VA; Newport News, VA; 
Hampton, VA; Portsmouth, VA; Currituck County, NC; Gloucester 
County, VA; Isle of Wight County, VA; James City County, VA; Mathews 
County, VA; Surry County, VA; York County, VA; Chesapeake city, VA; 
Hampton city, VA; Newport News city, VA; Norfolk city, VA; Poquoson 
city, VA; Portsmouth city, VA; Suffolk city, VA; Virginia Beach city, VA; 
Williamsburg city, VA. 



WA Seattle Area: Seattle-Tacoma-Bellevue, WA Metropolitan Statistical Area Principal 

Seattle, Bellevue, and a 1 0-mile buffer extending £itie s: Seattle, Tacoma Bellevue, Everett, Kent, Renton Seattle- 
from the border of the combined area. Bel levue- Everett, WA Metropolitan Division, King County, Snohomish 

County Tacoma, WA Metropolitan Division Pierce County. 



Wl Milwaukee Area: Milwaukee-Waukesha-West Allis, Wl Metropolitan Statistical Area 

Milwaukee and a 1 0-mile buffer extending from the P rinci ,P al 9, ities: Milwaukee, Waukesha West Allis; Milwaukee County, 
city border Ozaukee County, Washington County, Waukesha County. 



Source: GAO analysis of DHS and OMB — a OMB Bulletin No. 07-01 , announcing updates to metropolitan and micropolitan statistical 
areas as of December 2006, based on the Census Bureau's July 1 , 2004 and July 1 , 2005 population estimates. 
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Population Index: Neither maximizing nor minimizing the weight of the 
Population Index resulted in the movement of an area into or out of Tier 1 
for either FY 2007 or FY 2008. 

Economic Index: In FY 2007, minimizing the weight of the Economic Index 
had no effect on Tier 1 placement, but increasing the weight of the 
Economic Index by 12.8% resulted in a new area moving into Tier 1, 
displacing an area that had previously been ranked in the top 7. In FY 
2008, lowering the weight of the Economic Index by 15.25% resulted in a 
new area moving into the top 7 ranked areas, displacing an area that had 
been previously ranked as Tier 1, but maximizing the weight of the 
Economic Index had no effect on Tier 1 placement. 

National Infrastructure Index: In FY 2007, maximizing the weights of the 
National Infrastructure Index did not result in any change in those areas 
designated Tier 1, but lowering the National Infrastructure Index by 5.53% 
resulted in a new area moving into the Tier 1 areas, displacing an area that 
had been previously ranked as Tier 1. In FY 2008, increasing the weight of 
the National Infrastructure Index by 4.68% resulted in a new area moving 
into the top 7 ranked areas, displacing an area that had been previously 
ranked as Tier 1. Similarly, lowering the National Infrastructure Index by 
15% resulted in a new area moving into the Tier 1 areas. 

National Security Index: In FY 2007, minimizing the weight of the National 
Security Index also did not result in any change in those areas designated 
Tier 1, but increasing the National Security Index by 7.5% resulted in a new 
area moving into Tier 1, displacing an area that had been previously 
ranked as Tier 1. In FY 2008, lowering the weight of the National Security 
Index by 3.73% resulted in a new area moving into the top 7 ranked areas, 
displacing an area that had been previously ranked as Tier 1. Increasing 
the National Security Index by 10% resulted in a new area moving into Tier 
1, also displacing an area that had been previously ranked as Tier 1. 



Urban Area Sensitivity to 
Changes in Consequence 
Index Weights is Reduced 
in FY 2008 for Funding 
Eligibility 



While Tier 1 areas were similarly robust in both FY 2007 and FY 2008, the 
sensitivity of Tier 2 areas to changes in the weights of indices used to 
calculate risk scores was significant in FY 2007, but improved in FY 2008. 
In FY 2007, very small changes in the weights for the indices used to 
quantify risk for Tier 2 urban areas at the eligibility cut point resulted in 
changes in eligibility; however, FY 2008 results are more robust, as 
eligibility of urban areas is much less sensitive to changes in the index 
weights in the FY2008 model than it was in the FY2007 model. 
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Population Index: In FY 2007, decreasing the weight of the Population 
Index by 0.4% or increasing the weight of the Population Index by 4% 
resulted in one area displacing another area with regard to eligibility. 
However, neither maximizing nor minimizing the Population Index 
resulted in one area displacing another area with regard to eligibility in FY 
2008. 

Economic Index: In FY 2007, lowering the weight of the Economic Index 
by 0.24% or increasing the weight of the Economic Index by 2.4% resulted 
in one area displacing another area with regard to eligibility. By contrast, 
FY 2008 required an increase in the weight of the Economic Index by 
12.33% or a decrease in the weight of the Economic Index by 10.48% 
resulted in one area displacing another area with regard to eligibility. 

National Infrastructure Index: In FY 2007, changing the weight for the 
National Infrastructure Index by 1.58% (either increase or decrease) 
resulted in one area displacing another area with regard to eligibility, 
while the FY 2008 National Infrastructure Index required an increase in the 
weight by 5.67% or a decrease the weight by 4.54% to result in one area 
displacing another area with regard to eligibility. 

National Security Index: In FY 2007, increasing the weight for the National 
Security Index by 0.08% resulted in one area displacing another area with 
regard to eligibility, but FY 2008 required an increase in the weight for the 
National Security Index by 2.34% or a decrease in the weight of the 
National Security Index by 1.37% to result in one area displacing another 
area with regard to eligibility. 
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